System and Method for Dynamic Collection of System Management Data in a Mainframe Computing Environment

1. A system, comprising: a processor; a storage device accessible by the processor; a real time analytics program in the storage device; and a real time dispatcher program in the storage device, wherein: execution of the real time dispatcher program by the processor configures the system to implement functions, including functions to: retrieve, from a collection of previously generated system event records, a sequence of system event records, wherein each system event record: was previously generated at least in part as a result of an event occurring within the system; includes an indication of a creation time of the respective system event record and an indication of a source of the respective system event record; and was collected independently of the respective creation time or the respective source such that the respective system event record may have been collected before another earlier generated system event record; for each retrieved system event record: identify the source of the respective retrieved system event record; and place the respective retrieved system event record into one buffer of a plurality of buffers, the one buffer corresponding to the source of the respective system event record; and for each buffered system event record: retrieve the respective buffered system event record from the respective buffer only if: the respective creation time of the respective buffered system event record corresponds to a system-wide chronological order such that the respective buffered system event record is retrieved only after any other earlier generated system event records have been retrieved; and either: the respective buffered system event record is not a single remaining buffered system event record in the respective buffer; or each of the other buffers contains at least one buffered system event record; and dispatch a copy of the respective retrieved buffered system event record to the real time analytics program in accordance with the system-wide chronological order; and execution of the real time analytics program by the processor configures the system to implement functions, including functions to: receive dispatched copies of system event records in accordance with the system-wide chronological order; and produce, based at least in part on the received copies of system event records, analytics regarding events occurring within the system.

2. The system of claim 1 , further comprising a real time backup analysis program, wherein: further execution of the real time dispatcher program further configures the system to implement further functions, including functions to: for each retrieved buffered system event record: determine whether the respective retrieved buffered system event record corresponds to a particular type of event occurring within the system; and upon a determination that the respective retrieved buffered system event record corresponds to the particular type of event occurring within the system, dispatch another copy of the respective retrieved buffered system event record to the real time backup analysis program; and execution of the real time backup analysis program by the processor configures the system to implement functions, including functions to: receive dispatched copies of system event records; and determine, based at least in part on the received copies of system event records, whether one or more datasets within the system should be backed up.

3. The system of claim 2 , wherein the particular type of event is a dataset close.

4. The system of claim 1 , wherein the collection of previously generated system event records includes at least one of: system event records provided via a common log stream; system event records provided via a log stream created specifically to provide system event records to the real time dispatcher program; system event records provided via one or more datasets created specifically to provide system event records to the real time dispatcher program; and system event records provided via a batch dataset.

5. The system of claim 4 , further comprising a system event record extractor program, wherein: execution of the system event record extractor program configures the system to implement functions, including functions to: read individual system event records from at least one of: the common log stream; a result of a user exit; and one or more common datasets created to store system event records; write each individual system event record to the collection of previously generated system event records; and record, in an extractor checkpoint dataset, an indication that each read system event record has been written to the collection of previously generated system event records.

6. The system of claim 5 , wherein the user exit includes one of: a user exit configured to control writing any system event record to the one or more common datasets created to store system event records; a user exit configured to control writing selected system event records to the one or more common datasets created to store system event records; and a user exit invoked in cross memory mode and configured to control writing selected system event records to the one or more common datasets created to store system event records.

7. The system of claim 1 , further comprising at least two logical partitions wherein the indication of the source of the respective system event record includes an indication of the logical partition corresponding to the respective system event record.

8. An article of manufacture, comprising: a non-transitory machine readable medium; a real time analytics program embodied in the medium; and a real time dispatcher program embodied in the medium, wherein: execution of the real time dispatcher program by a processor supports functions, including functions to: retrieve, from a collection of previously generated event records, a sequence of event records, wherein each event record: was previously generated at least in part as a result of an event occurring within a system comprising the processor; includes an indication of a creation time of the respective event record and an indication of a source of the respective event record; and was collected independently of the respective creation time or the respective source such that the respective event record may have been collected before another earlier generated event record; for each retrieved event record: identify the source of the respective retrieved event record; and place the respective retrieved event record into one buffer of a plurality of buffers, the one buffer corresponding to the source of the respective event record; and for each buffered event record: retrieve the respective buffered event record from the respective buffer only if: the respective creation time of the respective buffered event record corresponds to a system-wide chronological order such that the respective buffered event record is retrieved only after any other earlier generated event records have been retrieved; and either: the respective buffered event record is not a single remaining buffered event record in the respective buffer; or each of the other buffers contains at least one buffered event record; and dispatch a copy of the respective retrieved buffered event record to the real time analytics program in accordance with the system-wide chronological order; and execution of the real time analytics program by the processor supports functions, including functions to: receive dispatched copies of event records in accordance with the system-wide chronological order; and produce, based at least in part on the received copies of event records, analytics regarding events occurring within the system.

9. The article of claim 8 , further comprising a real time backup analysis program embodied in the medium, wherein: further execution of the real time dispatcher program by the processor supports further functions, including functions to: for each retrieved buffered event record: determine whether the respective retrieved buffered event record corresponds to a particular type of event occurring within the system; and upon a determination that the respective retrieved buffered event record corresponds to the particular type of event occurring within the system, dispatch another copy of the respective retrieved buffered event record to the real time backup analysis program; and execution of the real time backup analysis program by the processor supports functions, including functions to: receive dispatched copies of event records; and determine, based at least in part on the received copies of event records, whether one or more datasets within the system should be backed up.

10. The article of claim 9 , wherein the particular type of event is a dataset close.

11. The article of claim 8 , wherein the collection of previously generated event records includes at least one of: event records provided via a common log stream; event records provided via a log stream created specifically to provide event records to the real time dispatcher program; event records provided via one or more datasets created specifically to provide event records to the real time dispatcher program; and event records provided via a batch dataset.

12. The article of claim 11 , further comprising an event record extractor program embodied in the medium, wherein: execution of the event record extractor program by the processor supports functions, including functions to: read individual event records from at least one of: the common log stream; a result of a user exit; and one or more common datasets created to store event records; write each individual event record to the collection of previously generated event records; and record, in an extractor checkpoint dataset, an indication that each read event record has been written to the collection of previously generated event records.

13. The article of claim 12 , wherein the user exit includes one of: a user exit configured to control writing any system event record to the one or more common datasets created to store system event records; a user exit configured to control writing selected system event records to the one or more common datasets created to store system event records; and a user exit invoked in cross memory mode and configured to control writing selected system event records to the one or more common datasets created to store system event records.

14. A method, comprising: retrieving, by a real time dispatcher process executing on a processor and from a collection of previously generated system event records, a sequence of system event records, wherein each system event record: was previously generated at least in part as a result of an event occurring within a system comprising the processor; includes an indication of a creation time of the respective system event record and an indication of a source of the respective system event record; and was collected independently of the respective creation time or the respective source such that the respective system event record may have been collected before another earlier generated system event record; for each retrieved system event record: identifying the source of the respective retrieved system event record; and placing the respective retrieved system event record into one buffer of a plurality of buffers, the one buffer corresponding to the source of the respective system event record; and for each buffered system event record: retrieving the respective buffered system event record from the respective buffer only if: the respective creation time of the respective buffered system event record corresponds to a system-wide chronological order such that the respective buffered system event record is retrieved only after any other earlier generated system event records; and either: the respective buffered system event record is not a single remaining buffered system event record in the respective buffer; or each of the other buffers contains at least one buffered system event record; and dispatching, to a real time analytics process executing on the processor and in accordance with the system-wide chronological order, a copy of the respective retrieved buffered system event record; and producing, by the real time analytics process and based at least in part on the received copies of system event records, analytics regarding events occurring within the system.

15. The method of claim 14 , further comprising: for each retrieved buffered event record: determining, by the real time dispatcher process, whether the respective retrieved buffered system event record corresponds to a particular type of event occurring within the system; and upon a determination that the respective retrieved buffered system event record corresponds to the particular type of event occurring within the system, dispatching, to a real time backup analysis process executing on the processor, another copy of the respective retrieved buffered system event record; and determining, by the real time backup analysis process and based at least in part on the received copies of system event records, whether one or more datasets within the system should be backed up.

16. The method of claim 15 , wherein the particular type of event is a dataset close.

17. The method of claim 14 , wherein the collection of previously generated event records includes at least one of: event records provided via a common log stream; event records provided via a log stream created specifically to provide event records to the real time dispatcher program; event records provided via one or more datasets created specifically to provide event records to the real time dispatcher program; and event records provided via a batch dataset.

18. The method of claim 17 , further comprising: reading, by an event record extractor process executing on the processor, individual system event records from at least one of: the common log stream; a result of a user exit; and one or more common datasets created to store event records; writing each individual system event record to the collection of previously generated system event records; and recording, in an extractor checkpoint dataset, an indication that each read event record has been written to the collection of previously generated system event records.

19. The method of claim 18 , wherein the user exit includes one of: a user exit configured to control writing any system event record to the one or more common datasets created to store system event records; a user exit configured to control writing selected system event records to the one or more common datasets created to store system event records; and a user exit invoked in cross memory mode and configured to control writing selected system event records to the one or more common datasets created to store system event records.